Privacy Policy

1. Controller of personal data

The controller of the personal data processed in connection with the use of the website www.scpmanciu.ro, hereinafter referred to as the “Website”, is avocat Manciu Cătălin Adrian, registered with Baroul București (Bucharest Bar Association), who practices within Cabinet Individual de Avocat Manciu Cătălin Adrian (Manciu Cătălin Adrian Individual Law Office), with its professional registered office in Bucharest, 14 Str. Octav Cocărăscu, District 1, having tax identification number RO23560945, hereinafter referred to as the “Controller”.

For questions concerning the processing of data or for exercising your rights, you may use the following contact details:

• E-mail: office@scpmanciu.ro;
• Telephone: 0792 626 248;
• Correspondence address: Bucharest, 59 Str. Dr. Iacob Felix, 2nd floor, District 1, postal code 011033.

2. Scope

This policy describes the processing of personal data in connection with accessing the Website, using the contact form and managing the preliminary correspondence arising from the requests received.

The processing of data in connection with legal assistance and representation services may involve additional purposes, categories of data, recipients and retention periods. The relevant information is provided in the context of the respective processing activities, in accordance with the law and subject to professional secrecy.

Data is processed in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter referred to as the “GDPR”, as well as with the other applicable legal provisions.

3. Data processed and its sources

3.1. Contact form and correspondence

The contact form requests:

• name, e-mail address and message content — mandatory fields;
• telephone number and area of interest — optional fields.

Information concerning the language in which the form was completed is also processed, in order to manage the request and formulate the response.

Providing the data is not a legal obligation. Completing the mandatory fields is necessary for submitting the form and managing the request through this functionality. Failure to complete the optional fields does not prevent the message from being submitted.

The data is obtained directly from you. The message content and subsequent correspondence may also include other information that you choose to communicate, including data concerning the persons involved in the situation described.

Please send only the information necessary for the initial contact and for understanding the general subject matter of the request.

3.2. Technical data

Accessing the Website entails the processing of the IP address and the technical information necessary for transmitting the pages and managing the connection. The infrastructure may record the date and time of the request, the resource accessed, browser information and data concerning errors or security events.

In order to limit automated or abusive submissions through the contact form, the Website application temporarily keeps the IP address in the server’s working memory for no more than ten minutes. Under this mechanism, the IP address is not saved in the message database and is not associated with the stored message.

This period concerns exclusively the mechanism for limiting submissions. The processing of data in the infrastructure logs is separate.

4. Purposes and legal bases

4.1. Requests for legal services on your own behalf

When you request legal services on your own behalf, the data necessary for analysing the request and carrying out the pre-contractual steps requested by you is processed on the basis of Article 6(1)(b) GDPR.

These steps may include clarifying the subject matter of the request, assessing the possibility of taking on the case and discussing the terms of a possible collaboration.

4.2. Other communications and requests submitted on behalf of organisations

For communications that do not constitute pre-contractual steps taken by the data subject, including requests submitted by representatives or contact persons of legal entities, processing is based on Article 6(1)(f) GDPR.

The legitimate interest pursued consists in managing professional correspondence, communicating with interested persons and assessing the requests received.

4.3. Checking conflicts of interest

The data necessary for checking and avoiding conflicts of interest is processed in order to comply with the professional obligations provided for by Legea nr. 51/1995 (Law no. 51/1995) and Statutul profesiei de avocat (Statute of the Legal Profession), on the basis of Article 6(1)(c) GDPR.

The check is limited to the information necessary for identifying the persons involved, the general subject matter of the request and the circumstances relevant to the existence of a conflict.

4.4. Records of correspondence and protection of rights

Maintaining proportionate records of requests and the processing necessary for establishing, exercising or defending rights is based on Article 6(1)(f) GDPR.

The legitimate interests pursued consist in ensuring the continuity of communications, documenting how requests are managed and protecting the rights and legitimate interests of the Controller.

4.5. Operation and security of the Website

Technical data is processed for providing the Website, preventing unauthorised access, limiting automated or abusive messages and identifying or remedying incidents.

The legal basis is Article 6(1)(f) GDPR, the legitimate interest pursued being to ensure the operation, integrity and security of the Website and communications.

Processing based on legitimate interest is carried out taking into account its necessity and proportionality, as well as the rights, freedoms and reasonable expectations of the data subjects.

Data submitted through the form is not used for marketing, newsletter subscriptions or sending unsolicited commercial offers.

5. Sensitive data and information concerning other persons

The contact form is intended to initiate communication. Please do not send through it the complete documentation of a case, special categories of data, such as health data, or data concerning criminal convictions and offences.

If such information is nevertheless received, the necessity and lawfulness of processing it are assessed in relation to the specific request. Data that is not necessary is deleted, unless there is a legal reason for retaining it.

The mere voluntary transmission of information is not considered, in itself, explicit consent and does not justify any subsequent use.

Special categories of data are processed only where there is an applicable legal basis under Article 6 GDPR and a condition provided for by Article 9 GDPR. In the context of a legal request, this may be the necessity for the establishment, exercise or defence of a right in court, where the legal conditions are met.

Data concerning criminal convictions and offences is processed only under the conditions of Article 10 GDPR and the legal provisions authorising the processing.

Data concerning other persons may originate from the person submitting the request or from the correspondence and documents communicated by that person. The information obligations towards such persons are fulfilled in accordance with Article 14 GDPR, subject to the relevant legal exceptions. In particular, information may not be required to the extent that the data must remain confidential under a legal obligation of professional secrecy, under the conditions of Article 14(5)(d) GDPR.

6. Recipients of the data

Data is not sold and is not disclosed for advertising purposes.

To the extent necessary for managing requests and operating the Website, the data may be accessed by:

• the managing lawyer, collaborating lawyers and authorised persons who participate in managing requests, in accordance with their duties;
• providers of hosting, databases, electronic communications, maintenance and information security services;
• authorities, institutions or other persons entitled to receive it, in accordance with the law and subject to professional secrecy.

The following services are used for operating the Website and managing correspondence:

• Vercel — hosting and Website infrastructure;
• Neon — the database in which requests are stored;
• Resend — sending e-mail notifications concerning requests received;
• Google Workspace — receiving, storing and managing electronic correspondence.

Providers that process data on behalf of the Controller act as processors and are subject to the requirements of Article 28 GDPR. They may use sub-processors under the conditions of the applicable contractual documents and the GDPR.

For certain technical data generated by services and for their own security or legal-compliance operations, providers may act as independent controllers, within the limits described in their privacy documentation.

Any communication to authorities is assessed in relation to the requesting party’s competence, the legal basis for the request and the obligations concerning professional secrecy.

7. Location of data and international transfers

The Neon database used to store requests is hosted in a region of the European Union.

However, the services used have international infrastructure and operations. The primary storage of certain data in the European Union does not exclude access from outside the European Economic Area or processing by sub-processors located in other countries.

Vercel indicates in its documentation that it has primary processing facilities in the United States of America and uses distributed infrastructure. Documentation concerning data processing and contractual transfer mechanisms is available at vercel.com/legal/dpa.

Neon uses the infrastructure associated with the project’s region and auxiliary services of the Databricks group and its sub-processors, which may involve processing in the United States of America. The terms applicable to the service and the relevant data protection documents are available at neon.com/platform-terms.

Resend stores customer data, including message content and delivery logs, in the United States of America. Selecting a European region for sending e-mails does not change the storage location. The provider’s data processing agreement includes the standard contractual clauses adopted by the European Commission and is available at resend.com/legal/dpa.

Google Workspace uses international infrastructure, and data may be processed in the countries where Google or its sub-processors maintain infrastructure, including the United States of America. Use of the service does not, in itself, entail exclusive storage in the European Union. Google’s data processing agreement governs transfers and includes standard contractual clauses for transfers requiring such safeguards. The documentation is available at Google — Cloud Data Processing Addendum.

International transfers are subject to the conditions of Chapter V GDPR. Publishing a provider’s documentation does not replace verifying whether the transfer mechanism applies to the specific service and contractual relationship.

You may request additional information concerning transfers and a copy of the applicable safeguards at office@scpmanciu.ro. Documents may be provided while protecting confidential information and the data of other persons, without withholding the information concerning the relevant safeguards.

8. Data retention period

Data is retained only for the period necessary for the purposes for which it was collected, taking into account the nature of the request, legal and professional obligations and the need to protect rights.

8.1. Requests and correspondence

Requests that do not lead to a collaboration are retained for the duration of their resolution and, subsequently, for no more than three years from their closure, where retention is necessary for documenting communications or defending rights.

The need for retention is reassessed, and data that is no longer necessary may be deleted earlier. The period is not automatically extended by the receipt of subsequent messages unrelated to the initial request.

Unsolicited, abusive or manifestly unrelated messages are deleted after their nature has been identified and verified, except for information necessary for documenting an incident or defending a right.

8.2. Checking conflicts of interest

If certain information needs to be retained after the request has been closed, only the minimum identification data and the information indispensable for checking conflicts of interest are retained.

The period is determined by the persistence of the relevant professional obligations, the risk of a conflict and the need to protect confidential information. This record does not entail retaining the initial correspondence in full.

8.3. Technical data and recovery systems

The following periods specific to the services used apply:

• Limiting submissions through the form: the IP address is retained for no more than ten minutes in the application’s working memory.
• Vercel execution logs: the retention period under the current configuration is one hour. This does not represent a general deadline for deleting all of the provider’s technical data.
• Neon restoration history: the available window is up to six hours, within the volume provided by the service. This window concerns restoration history and is not equivalent to a general deadline for deleting all copies.
• Resend: e-mails and logs are retained for 30 days, while backups have a retention period of seven days.
• Google Workspace: correspondence is retained according to the periods established for the respective requests. After permanent deletion and the end of the possibility of recovery by the user, deletion from Google’s systems follows the provider’s contractual process, with a maximum period of 180 days, subject to legal retention obligations.

Technical periods do not justify extending the use of data for current purposes. Data deleted from active records is not used to manage requests, even if deletion from recovery systems requires an additional period.

8.4. Legal services and preservation obligations

If the request leads to the provision of legal services, the relevant data is processed and retained in accordance with the obligations and specific purposes of the legal assistance relationship, with the relevant information being provided to the data subjects.

In the event of litigation, an investigation or a legal obligation to preserve data, the relevant data may be retained until the respective need ceases and the applicable statutory periods expire.

When the need for retention ceases, the data is deleted or effectively anonymised.

9. Data security and professional secrecy

The Controller applies technical and organisational measures appropriate to the nature of the data and the risks of processing, including encryption of communications with the Website, access control for requests and measures against unauthorised access and abusive use.

Access to data is limited to persons who need it to perform their duties and who are subject to the applicable confidentiality obligations.

Information communicated in connection with the practice of the profession benefits from the protection of professional secrecy under the conditions of Legea nr. 51/1995 and Statutul profesiei de avocat. This protection may also apply in the absence of a legal assistance agreement, depending on the nature of the information and the circumstances in which it was communicated.

For sending sensitive documents or information, please request in advance that an appropriate communication channel be established.

10. Cookies and external resources

The Website does not use analytics or advertising cookies for visitors, traffic measurement tools or social media modules intended to track users.

Fonts, maps and other content elements are not embedded through separate external services that would result in the visitor’s data being transmitted to providers of such resources.

These statements do not exclude the processing of technical data necessary for providing the Website through the infrastructure of the providers mentioned in this policy.

An authentication cookie intended for authorised persons is used in the administration area. It is necessary for access to and operation of that area and is not used to track visitors.

If technologies for which the law requires consent are introduced, they will be used only after the relevant information has been provided and the necessary consent has been obtained.

11. Profiling and automated decision-making

The data processed for the purposes described in this policy is not used by the Controller to create profiles.

The Controller does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.

The technical mechanisms for limiting abusive requests are used to protect the Website and do not constitute a legal assessment of your request.

12. Your rights

Under the conditions and within the limits provided by the GDPR, you have:

• Right of access: to obtain confirmation that data is being processed, information concerning such processing and a copy of the data;
• Right to rectification: to request the correction of inaccurate data or the completion of incomplete data;
• Right to erasure: to request the deletion of data where the legal conditions are met;
• Right to restriction of processing: to request that the use of data be limited in the situations provided by law;
• Right to data portability: for data provided by you and processed automatically on the basis of Article 6(1)(b) GDPR, to receive it in a structured, commonly used and machine-readable format and, where technically feasible, to request its direct transmission to another controller.

Right to object

You may object at any time, on grounds relating to your particular situation, to the processing of data based on legitimate interest.

To exercise this right, you may send a request to office@scpmanciu.ro.

Following an objection, processing will cease, unless the Controller demonstrates compelling legitimate grounds that override your interests, rights and freedoms or the need to process the data for the establishment, exercise or defence of a right in court.

Limits on exercising rights

Rights are not absolute. Requests must be handled in compliance with legal retention obligations, professional secrecy and the rights and freedoms of other persons.

Any limitations are applied only under the conditions of the law and are explained in the response to the extent permitted by law.

13. Exercising rights

Requests may be sent to office@scpmanciu.ro or by correspondence to: Bucharest, 59 Str. Dr. Iacob Felix, 2nd floor, District 1, postal code 011033.

The response is communicated without undue delay and, in any event, no later than one month after receipt of the request. If necessary, taking into account the complexity and number of requests, the period may be extended by two months. You will be informed of the extension and the reasons for it within one month of receiving the request.

If there are reasonable doubts concerning the identity of the requesting party, additional information strictly necessary to confirm identity may be requested. A copy of an identity document is not requested automatically.

Exercising rights is, in principle, free of charge. For manifestly unfounded or excessive requests, in particular because of their repetitive nature, a reasonable fee may be charged or action may be refused, under the conditions of the GDPR.

If no action is taken on the request, you will be informed, within the statutory period, of the reasons and of the possibility of lodging a complaint with the supervisory authority and bringing proceedings before the courts.

14. Complaints and remedies

For any questions concerning the processing of data, you may contact the Controller directly. This step is optional and does not condition the referral of the matter to the authorities or courts.

You have the right to lodge a complaint with Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (National Supervisory Authority for Personal Data Processing), headquartered in Bucharest, 28–30 B-dul G-ral. Gheorghe Magheru, District 1, postal code 010336, website: www.dataprotection.ro.

Under the GDPR, you may also contact the supervisory authority in the Member State where you have your habitual residence, place of work or where you consider that the alleged infringement took place.

You also have the right to bring proceedings before the competent courts.

15. Policy updates

This policy may be updated to reflect legislative amendments, changes to processing operations or changes to the Website configuration.

The updated version is published on this page, indicating the date of the latest update. Changes requiring separate information are communicated by appropriate means.

If the data is intended to be used for a purpose other than that for which it was collected, the necessary information is provided before the subsequent processing, under the conditions of the GDPR.

Publishing an updated version does not replace obtaining consent where consent is required by law.